CVE-2026-64916

Think of SharePoint like a company bulletin board with pages that employees visit. This flaw lets an attacker who already has a SharePoint account sneak in “fake content” scripts so that the page can look like something trustworthy while it’s actually misleading users. That can lead to internal phishing, where employees are tricked into actions like entering passwords or approving requests.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition, because the attacker must already have valid (lower-privilege) credentials to exploit it. The attack happens over the network and requires that users interact with the affected page (so it’s about tricking someone who visits the page), rather than a purely background takeover. Treat it as a risk when a malicious or untrusted user account can reach SharePoint (for example, an account that shouldn’t have access, is shared, or was recently compromised).

This is RED because it’s a spoofing-style web attack that can be used by an attacker who already has SharePoint credentials to mislead other users. Even though there’s no confirmed dated report of incidents in the provided material, a new patch is available and the patching work should be prioritized promptly to reduce exposure from internal or compromised accounts.

1. Confirm whether you’re running a listed product.
   • Identify which SharePoint edition you have: SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition.
   • Confirm the installed build/version.
2. Compare your version to the fixed versions.
   • Enterprise Server 2016 must be at least 16.0.5565.1001.
   • Server 2019 must be at least 16.0.10417.20198.
   • Subscription Edition must be at least 16.0.19725.20522.
3. Upgrade following Microsoft’s guidance.
   • Use the Microsoft update guide for CVE-2026-64916 and apply the recommended SharePoint patch for your exact edition.
4. Temporary workaround (if patching is delayed).
   • Reduce the chance that an attacker with credentials can reach or affect SharePoint pages: review user access and remove any accounts that shouldn’t have SharePoint access.
   • If you operate a least-privilege model, ensure only trusted users have the ability to change or contribute content that could be rendered to other users.
5. Post-patch validation.
   • Re-check the SharePoint version/build to confirm you’re on (or above) the fixed version for your edition.
6. What to monitor.
   • Monitor SharePoint and server logs for suspicious activity originating from user accounts that should not be making changes.
   • Pay special attention to signs of unexpected page/content changes or abnormal login patterns from low-privilege accounts.

CVE-2026-64916 is an authenticated web vulnerability in Microsoft Office SharePoint (CWE-79) where improper neutralization during web page generation enables cross-site scripting (XSS). The mechanism is that an authorized attacker (low privileges required) can inject malicious script into SharePoint-rendered pages over the network; the attack involves user interaction to view/trust the spoofed page content. The finding set includes no KEV listing and no dated incident report in the provided news/exploitation materials, and there is no public exploit code on record. However, patch information is available for multiple SharePoint editions, and actor/press attention indicates high visibility (Lazarus group noted in PULSE), so patching should be treated as urgent.

Verdict alignment: despite medium CVSS scoring, the operational risk comes from credentialed misuse (spoofing internal pages) and the need for only low privilege plus a believable user-facing interaction. The EPSS is provided as a prediction (trend flat), but public urgency here is driven by the confirmed existence of a practical spoofing path and the availability of fixes rather than prediction alone.